From 6c7d708c98ea3fb17ac4815e99e36275289f712d Mon Sep 17 00:00:00 2001 From: x032205 Date: Sat, 6 Dec 2025 19:44:57 -0500 Subject: [PATCH] generate pam access grant as part of post approval flow --- .../pam-account/pam-account-service.ts | 2 +- backend/src/server/routes/index.ts | 3 ++- .../approval-policy-service.ts | 5 ++++- .../approval-policy/approval-policy-types.ts | 5 ++++- .../pam-access/pam-access-policy-factory.ts | 22 +++++++++++++------ 5 files changed, 26 insertions(+), 11 deletions(-) diff --git a/backend/src/ee/services/pam-account/pam-account-service.ts b/backend/src/ee/services/pam-account/pam-account-service.ts index 538f6407a..475e695ec 100644 --- a/backend/src/ee/services/pam-account/pam-account-service.ts +++ b/backend/src/ee/services/pam-account/pam-account-service.ts @@ -554,7 +554,7 @@ export const pamAccountServiceFactory = ({ accountPath: `${folderPath}/${account.name}` }; - const canAccess = await fac.canAccess(approvalRequestGrantsDAL, actor.id, resource.projectId, inputs); + const canAccess = await fac.canAccess(approvalRequestGrantsDAL, resource.projectId, actor.id, inputs); if (canAccess) { // Grant exists, allow access without checking permission diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 511022ccd..792a310e0 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -2485,7 +2485,8 @@ export const registerRoutes = async ( approvalRequestStepEligibleApproversDAL, approvalRequestApprovalsDAL, userGroupMembershipDAL, - notificationService + notificationService, + approvalRequestGrantsDAL }); // setup the communication with license key server diff --git a/backend/src/services/approval-policy/approval-policy-service.ts b/backend/src/services/approval-policy/approval-policy-service.ts index d9493229f..3c04a7866 100644 --- a/backend/src/services/approval-policy/approval-policy-service.ts +++ b/backend/src/services/approval-policy/approval-policy-service.ts @@ -14,6 +14,7 @@ import { TApprovalPolicyStepsDALFactory, TApprovalRequestApprovalsDALFactory, TApprovalRequestDALFactory, + TApprovalRequestGrantsDALFactory, TApprovalRequestStepEligibleApproversDALFactory, TApprovalRequestStepsDALFactory } from "./approval-policy-dal"; @@ -41,6 +42,7 @@ type TApprovalPolicyServiceFactoryDep = { approvalRequestDAL: TApprovalRequestDALFactory; approvalRequestStepsDAL: TApprovalRequestStepsDALFactory; approvalRequestStepEligibleApproversDAL: TApprovalRequestStepEligibleApproversDALFactory; + approvalRequestGrantsDAL: TApprovalRequestGrantsDALFactory; userGroupMembershipDAL: TUserGroupMembershipDALFactory; notificationService: TNotificationServiceFactory; permissionService: Pick; @@ -56,6 +58,7 @@ export const approvalPolicyServiceFactory = ({ approvalRequestDAL, approvalRequestStepsDAL, approvalRequestStepEligibleApproversDAL, + approvalRequestGrantsDAL, userGroupMembershipDAL, notificationService, permissionService, @@ -598,7 +601,7 @@ export const approvalPolicyServiceFactory = ({ const fac = APPROVAL_POLICY_FACTORY_MAP[updatedRequest.type as ApprovalPolicyType]( updatedRequest.type as ApprovalPolicyType ); - await fac.postApprovalRoutine(newRequest as TApprovalRequest); + await fac.postApprovalRoutine(approvalRequestGrantsDAL, newRequest as TApprovalRequest); } return { request: newRequest }; diff --git a/backend/src/services/approval-policy/approval-policy-types.ts b/backend/src/services/approval-policy/approval-policy-types.ts index 560b06c40..b0f2dd530 100644 --- a/backend/src/services/approval-policy/approval-policy-types.ts +++ b/backend/src/services/approval-policy/approval-policy-types.ts @@ -73,7 +73,10 @@ export type TApprovalRequestFactoryValidateConstraints

boolean; -export type TApprovalRequestFactoryPostApprovalRoutine = (request: TApprovalRequest) => Promise; +export type TApprovalRequestFactoryPostApprovalRoutine = ( + approvalRequestGrantsDAL: TApprovalRequestGrantsDALFactory, + request: TApprovalRequest +) => Promise; export type TApprovalResourceFactory< I extends TApprovalPolicyInputs, diff --git a/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts b/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts index f338cb97b..802632c06 100644 --- a/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts +++ b/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts @@ -74,11 +74,7 @@ export const pamAccessPolicyFactory: TApprovalResourceFactory< return grants.some((grant) => { const grantAttributes = grant.attributes as TPamAccessPolicyInputs; const isMatch = picomatch(grantAttributes.accountPath); - return ( - grantAttributes.resourceId === inputs.resourceId && - isMatch(inputs.accountPath) && - (!grant.expiresAt || grant.expiresAt > new Date()) - ); + return isMatch(inputs.accountPath) && (!grant.expiresAt || grant.expiresAt > new Date()); }); }; @@ -92,8 +88,20 @@ export const pamAccessPolicyFactory: TApprovalResourceFactory< return reqDuration >= ms(durationConstraint.min) && reqDuration <= ms(durationConstraint.max); }; - const postApprovalRoutine: TApprovalRequestFactoryPostApprovalRoutine = async (_request) => { - // Placeholder + const postApprovalRoutine: TApprovalRequestFactoryPostApprovalRoutine = async (approvalRequestGrantsDAL, request) => { + const inputs = request.requestData.requestData; + const durationMs = ms(inputs.accessDuration); + const expiresAt = new Date(Date.now() + durationMs); + + await approvalRequestGrantsDAL.create({ + projectId: request.projectId, + requestId: request.id, + granteeUserId: request.requesterId, + status: ApprovalRequestGrantStatus.Active, + type: request.type, + attributes: inputs, + expiresAt + }); }; return {